SecureDrop: How Newsrooms Take Leaks Safely
SecureDrop is a Tor onion inbox for sources. What the system protects, what a compromised laptop still leaks, and how it differs from anonymous dump forums.
Most of this site is about markets, scams and seizures. SecureDrop is the other use of the same overlay: a newsroom runs an onion service so a source can send documents without creating an email account or a cloud login in their own name. Freedom of the Press Foundation maintains the software. Major papers have published the onion on their clearnet sites for years. That does not make the path magic. It makes the inbox harder to subpoena in the obvious way.
How a SecureDrop submission is supposed to work
The source opens Tor Browser — ideally from a machine that is not their work laptop — and types the onion address copied from the newsroom's HTTPS page, not from a wiki list. They land on a form, receive a codename, and upload files. They come back later with that codename to read a reply.
On the newsroom side, journalists retrieve the files from a hardened workstation, often with an air gap between the internet-facing box and the machine that opens documents. The stack exists so that a source does not have to trust Gmail, and so that the paper does not keep a mail server full of real names next to the leak.
GlobaLeaks is the other widely deployed open-source option, used by NGOs and some newsrooms that want a similar onion form without the full SecureDrop hardware ritual. Several European outlets and transparency groups have run it. The threat model is related: hide the transport, then still handle the files as if they are hostile.
Publications that have publicly documented a SecureDrop include The New York Times, The Washington Post, The Guardian and a long list on the Freedom of the Press Foundation directory. Always start from the outlet's own site. A search result that says "NYT SecureDrop" and offers a different onion is a phish.
What the design protects
- The ISP of the source does not see a connection to nytimes.com's mail server. It sees Tor (or a bridge).
- The newsroom's public web host does not see the source's IP. The submission lands on the onion service.
- A subpoena for "who emailed this attachment" does not have a neat mailbox to open. There is a codename and an encrypted drop.
That is a lot, relative to a Proton inbox opened from the office Wi-Fi. It is the reason journalists still print the onion in the footer.
What it cannot protect
A compromised source device sees the files before Tor does. Workplace endpoint software, a keylogger, or a printer that logged the document (the Reality Winner case: classified pages traced in part through printer tracking dots, 2017–2018, 63-month sentence) will not be fixed by an onion form.
Behaviour still leaks. Submitting from the newsroom's own building, submitting during a shift, telling a colleague, keeping the files on a personal Dropbox — none of that is in the SecureDrop threat model. Metadata inside the documents (author fields, GPS, revision history) travels with the upload unless someone strips it.
Timing still leaks. A unique document that only five people could have printed, combined with badge logs, is a classic investigation. Tor does not touch badge logs.
Tails is the usual extra step FPF and newsroom guides recommend for sources who need a clean boot. It is not part of SecureDrop itself. It is how you stop the everyday OS from remembering the session.
Not the same as a leak forum
RaidForums-style boards and "anonymous" dump sites are public. The audience is the world, including the employer and the police, immediately. There is no journalist making a privilege claim, no redaction, and no relationship. A SecureDrop inbox is a private channel to a newsroom that has lawyers and an editor. That is a different legal and practical object, even though both use Tor.
Sources who want maximum noise sometimes do both and then wonder why they were easy to find. The journalists' workflow on this site is written from the reporter side; the short version for sources is: one channel, one newsroom you chose on purpose, no extra copies.
Practical source-protection principles (not a kit)
- Copy the onion from the outlet's HTTPS site you typed yourself.
- Use a browser and OS that are not your employer's image. Work laptops report home.
- Assume every file is full of metadata. Strip or reprint-to-PDF on a clean machine if you know how; if you do not, tell the journalist and let their process handle it.
- Do not register a new mail account "as backup" from the same apartment.
- Do not ask a random Telegram "journalist" for an alternative onion.
The ecosystem cluster is mostly about search and forums. This page sits here because SecureDrop is part of how information leaves the dark web and arrives in public, not part of how people shop.
Frequently Asked Questions
Is SecureDrop anonymous?
It hides the transport and avoids an identified mailbox. It does not hide a dirty device, a unique document, or a source who talks. FPF's own documentation is explicit about those limits.
Where do I find a newsroom's real onion?
On that newsroom's official website, usually in the footer or a "tips" page served over HTTPS. Not on a directory, not in a search ad, not in an email that arrived unsolicited.
What is the difference between SecureDrop and GlobaLeaks?
Both are open-source submission platforms that can run as onions. SecureDrop is the newsroom-oriented stack with a heavier operational ritual; GlobaLeaks is more widely reused by NGOs and smaller orgs. The source-facing idea is similar.
Can a newsroom be forced to reveal a SecureDrop source?
Legal pressure lands on journalists and their notes, not on a magic shield. The software reduces the obvious server logs. It does not create a new privilege. That is a lawyer conversation in the relevant country.